> you can crawl the internet for selfies and then try and tie that face with the person it belongs to

Yeeeah .. this is not the sort of thing that GDPR ought to allow, though.